Email: 633766 Autolearn: 0 AvgScore: 4.32 AvgScanTime: 4.36 sec Spam: 208711 Autolearn: 0 AvgScore: 13.39 AvgScanTime: 5.23 sec Ham: 425055 Autolearn: 0 AvgScore: -0.13 AvgScanTime: 3.93 sec Time Spent Running SA: 766.96 hours Time Spent Processing Spam: 303.33 hours Time Spent Processing Ham: 463.62 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 200177 90.21 95.91 87.41 2 DKIM_SIGNED 167943 73.50 80.47 70.07 3 XM_DK_Pass 164247 71.99 78.70 68.69 4 DCC_CHECK 162557 48.16 77.89 33.56 5 DKIM_VALID 156059 67.83 74.77 64.42 6 XMListUnsubscribeExists 142298 52.79 68.18 45.23 7 DKIM_VALID_AU 120768 48.83 57.86 44.40 8 XM_H_QuotedFrom 105874 39.04 50.73 33.29 9 XM_DK_Undo_02 98141 24.35 47.02 13.22 10 BAYES_99 92525 22.98 44.33 12.50 11 BAYES_999 77777 19.57 37.27 10.88 12 MIME_HTML_ONLY 77687 24.36 37.22 18.04 13 HTML_FONT_LOW_CONTRAST 71874 29.17 34.44 26.58 14 TR_DCC_Bayes_99 70995 15.24 34.02 6.03 15 LOC_TINY_FONT_1 70618 25.25 33.84 21.04 16 BAYES_50 63431 49.37 30.39 58.69 17 XMSubLong 56970 21.54 27.30 18.71 18 FVGT_m_MULTI_ODD 52150 22.26 24.99 20.92 19 T_TM2_M_HEADER_IN_MSG 46136 27.94 22.11 30.80 20 DKIM_VALID_EF 44024 24.54 21.09 26.23 21 DCC_CHECK_NEGATIVE 42705 49.98 20.46 64.48 22 T_KAM_HTML_FONT_INVALID 41444 16.33 19.86 14.60 23 XM_Multi_Part_URI 41262 13.76 19.77 10.80 24 XM_Body_Dirty_Words 38833 13.84 18.61 11.50 25 RELAYCOUNTRY_META 35608 10.02 17.06 6.56 26 HTML_IMAGE_RATIO_02 32921 9.83 15.77 6.91 27 MultiRelay 32167 17.13 15.41 17.98 28 FSL_BULK_SIG 28842 9.15 13.82 6.86 29 BOTNET 26567 4.97 12.73 1.16 30 XM_Evil_Numbers_Gen 26325 9.11 12.61 7.38 31 BOTNET_IPINHOSTNAME 25104 7.53 12.03 5.32 32 FROM_EXCESS_BASE64 24239 6.11 11.61 3.40 33 LOTS_OF_MONEY 24057 10.55 11.53 10.07 34 UNTRUSTED_Relay 23162 5.67 11.10 3.01 35 XMSexyCombo_05 22260 5.68 10.67 3.23 36 XM_UncommonTLD01 21790 5.54 10.44 3.14 37 HTML_MIME_NO_HTML_TAG 20762 4.90 9.95 2.42 38 T_XMDrugObfuBody_14 19873 8.03 9.52 7.29 39 HTML_IMAGE_RATIO_04 18887 6.74 9.05 5.60 40 MPART_ALT_DIFF 17599 4.59 8.43 2.71 41 BAYES_80 17483 5.45 8.38 4.02 42 XM_B_Phish_Phrases 17382 5.68 8.33 4.38 43 HTML_IMAGE_RATIO_06 16224 4.93 7.77 3.54 44 MIME_HEADER_CTYPE_ONLY 15807 2.58 7.57 0.12 45 XM_H_Long_From01 15004 6.03 7.19 5.47 46 TooManyTo_001 14968 9.26 7.17 10.28 47 XMSubMetaSx_00 14677 4.85 7.03 3.78 48 SpammyFromTLD_02 14490 2.54 6.94 0.37 49 TM2_M_URI_OPT_OUT 14409 3.80 6.90 2.27 50 BAYES_60 14308 6.80 6.86 6.77 51 TR_XM_DocInvoice 14107 4.63 6.76 3.59 52 LotsOfNums_01 13801 7.83 6.61 8.43 53 XMNumbers 12103 4.13 5.80 3.31 54 DKIM_INVALID 11884 5.67 5.69 5.66 55 RCVD_IN_RP_SAFE 11542 6.95 5.53 7.65 56 BAYES_95 11030 3.56 5.28 2.72 57 XM_BadFromFormat 10577 1.80 5.07 0.20 58 MISSING_HEADERS 10489 1.99 5.03 0.50 59 HTML_FONT_SIZE_HUGE 10450 2.37 5.01 1.08 60 HTML_SHORT_LINK_IMG_1 10397 2.29 4.98 0.97 61 BODY_URI_ONLY 10244 1.66 4.91 0.06 62 HTML_IMAGE_ONLY_08 10181 2.31 4.88 1.05 63 MIME_HTML_MOSTLY 10127 3.31 4.85 2.55 64 SHORTENER_SHORT_IMG 10095 2.22 4.84 0.94 65 URI_BUFFLY 10090 2.22 4.83 0.94 66 XM_URI_RBL 9692 1.61 4.64 0.12 67 XM_UB50 9525 3.23 4.56 2.57 68 MIME_QP_LONG_LINE 9388 5.50 4.50 5.99 69 XM_SendGrid 9255 4.90 4.43 5.13 70 RCVD_IN_RP_RNBL 9229 1.49 4.42 0.05 71 XM_DIRTYINTL 8326 2.60 3.99 1.92 72 XMStrtUSub 8166 3.67 3.91 3.56 73 URIBL_BLACK 7893 1.27 3.78 0.04 74 RCVD_IN_RP_CERTIFIED 7850 5.71 3.76 6.67 75 MIME_HTML_ONLY_MULTI 7724 1.95 3.70 1.09 76 HTML_IMAGE_RATIO_08 7284 2.49 3.49 2.00 77 RCVD_IN_BL_SPAMCOP_NET 6996 1.35 3.35 0.37 78 RCVD_IN_MSPIKE_H2 6916 4.47 3.31 5.04 79 T_XMDrugObfuBody_08 6897 2.04 3.30 1.41 80 XM_CamelCaseFrm001 6854 2.12 3.28 1.54 81 DKIM_ADSP_NXDOMAIN 6599 1.27 3.16 0.34 82 XM_SPF_SoftFail 6525 2.35 3.13 1.96 83 RELAYCOUNTRY_RU 6475 1.03 3.10 0.01 84 RELAYCOUNTRY_CA 6467 1.90 3.10 1.31 85 T_TooManySym_01 6403 4.11 3.07 4.62 86 URI_HEX 6312 2.25 3.02 1.87 87 T_REMOTE_IMAGE 5970 4.07 2.86 4.66 88 XMDiploma_00 5228 2.04 2.50 1.82 89 MultiRelay_Combo 4861 0.88 2.33 0.16 90 MultiRelay_CC 4861 0.88 2.33 0.16 91 XM_OfRef6 4758 1.65 2.28 1.34 92 SUBJ_ALL_CAPS 4715 1.95 2.26 1.80 93 RCVD_IN_IADB_LISTED 4629 5.02 2.22 6.40 94 XM_H_Long_From02 4580 2.56 2.19 2.74 95 DIET_1 4499 1.16 2.16 0.67 96 XMSlimDrugH 4278 0.87 2.05 0.29 97 XMSexyCombo_01 4261 0.99 2.04 0.48 98 XM_HighProb1 4207 0.67 2.02 0.01 99 RCVD_IN_IADB_SPF 4182 4.36 2.00 5.52 100 XM_UB60 4143 0.71 1.99 0.09 101 XM_JunkDunk 4134 0.65 1.98 0.00 102 XMBdyGiftCard01 4051 1.12 1.94 0.71 103 RCVD_IN_IADB_SENDERID 3985 3.82 1.91 4.76 104 RCVD_IN_IADB_DK 3932 3.75 1.88 4.67 105 XMSubMetaI_00 3666 1.06 1.76 0.72 106 XMGenDplmaNmb 3613 1.28 1.73 1.06 107 LOW_PRICE 3442 0.65 1.65 0.15 108 SUBJ_DOLLARS 3350 0.66 1.61 0.19 109 UNPARSEABLE_RELAY 3250 3.37 1.56 4.26 110 BAYES_00 3229 5.31 1.55 7.16 111 XM_UB99 3227 0.53 1.55 0.03 112 BOTNET_NORDNS 3206 0.51 1.54 0.01 113 T_XMHurry_00 2966 0.81 1.42 0.51 114 XMPhish11 2956 1.28 1.42 1.21 115 TM2_M_VERY_LONG_WORD 2940 1.03 1.41 0.84 116 BAYES_40 2927 2.95 1.40 3.70 117 XMBody_17 2916 0.78 1.40 0.48 118 XMHTML_After_End 2903 0.75 1.39 0.44 119 XMPhish30 2887 0.71 1.38 0.38 120 TR_XM_RelayPhish 2864 0.78 1.37 0.49 121 T_XMDrugObfuBody_00 2858 1.43 1.37 1.46 122 XM_ProductURIs 2858 1.08 1.37 0.94 123 TR_LOTS_OF_MONEY2 2787 0.65 1.34 0.32 124 T_MONEY_PERCENT 2787 0.65 1.34 0.32 125 TR_XM_DK_Bayes 2719 3.57 1.30 4.68 126 SpammyFromTLD_01 2684 0.88 1.29 0.67 127 RELAYCOUNTRY_FR 2650 0.55 1.27 0.20 128 XM_DK_Undo_01 2639 1.62 1.26 1.80 129 HTML_TAG_BALANCE_BODY 2637 0.74 1.26 0.48 130 ALL_TRUSTED 2619 13.47 1.25 19.47 131 TR_Symld_Words 2576 1.63 1.23 1.82 132 MAILING_LIST_MULTI 2563 1.88 1.23 2.20 133 XM_UB80 2544 0.44 1.22 0.06 134 RELAYCOUNTRY_GB 2542 1.08 1.22 1.01 135 NO_DNS_FOR_FROM 2535 0.94 1.21 0.81 136 TR_Caps_n_Bayes_99 2516 0.44 1.21 0.06 137 TR_XM_DK_Bayes1 2513 3.18 1.20 4.15 138 XMBody_78 2510 0.63 1.20 0.35 139 XMHTMLBadTable_001 2477 0.75 1.19 0.53 140 XMWghtMeta_00 2471 0.40 1.18 0.02 141 T_TooManySym_02 2471 1.59 1.18 1.79 142 URI_TRY_3LD 2424 1.30 1.16 1.36 143 XMStockSpam_06 2424 1.14 1.16 1.12 144 TooManyTo_002 2381 2.37 1.14 2.97 145 BAYES_20 2376 2.21 1.14 2.74 146 XMMoneyMeta_00 2304 0.69 1.10 0.48 147 SUBJECT_DIET 2288 0.36 1.10 0.00 148 PLING_QUERY 2236 0.58 1.07 0.34 149 RELAYCOUNTRY_CN 2220 0.37 1.06 0.03 150 XMBrknScrpt_02 2183 0.67 1.05 0.48 151 TR_XM_DK_Bayes2 2170 2.56 1.04 3.31 152 TooManyTo_003 2143 1.84 1.03 2.24 153 T_Symld_Words_02 2141 0.78 1.03 0.66 154 RCVD_IN_IADB_VOUCHED 2124 3.33 1.02 4.46 155 XM_B_COPY_HTML 2088 0.61 1.00 0.42 156 URIBL_DBL_SPAM 2070 0.35 0.99 0.04 157 XM_UB999 2048 0.33 0.98 0.01 158 T_FILL_THIS_FORM_SHORT 2029 0.91 0.97 0.89 159 RELAYCOUNTRY_AT 2029 0.44 0.97 0.19 160 XMClaimOffer 1932 0.38 0.93 0.11 161 HTML_FONT_FACE_BAD 1873 0.59 0.90 0.44 162 RELAYCOUNTRY_NL 1849 0.40 0.89 0.16 163 URI_NOVOWEL 1821 0.63 0.87 0.51 164 REMOVE_BEFORE_LINK 1801 0.49 0.86 0.31 165 RELAYCOUNTRY_IN 1795 0.34 0.86 0.08 166 RELAYCOUNTRY_DE 1781 0.57 0.85 0.43 167 XM_PDF 1721 3.54 0.82 4.87 168 XM_H_PHPOS 1718 1.15 0.82 1.30 169 XMSexyCombo_04 1697 0.32 0.81 0.08 170 XM_UB95 1689 0.29 0.81 0.03 171 XM_RXBody 1683 0.31 0.81 0.07 172 TooManyTo_004 1663 0.99 0.80 1.09 173 XM_B_REG_HTML 1650 0.55 0.79 0.44 174 DKIM_ADSP_CUSTOM_MED 1642 1.00 0.79 1.10 175 XMSubMetaSSx_00 1631 0.39 0.78 0.20 176 XMPhish14 1562 0.43 0.75 0.27 177 ANY_BOUNCE_MESSAGE 1558 4.76 0.75 6.73 178 BOUNCE_MESSAGE 1556 4.76 0.75 6.73 179 HTTPS_HTTP_MISMATCH 1553 0.51 0.74 0.40 180 TooManyTo_005 1488 0.84 0.71 0.90 181 TRACKER_ID 1468 0.36 0.70 0.20 182 XM_H_PHPMailer 1464 0.65 0.70 0.63 183 FILL_THIS_FORM 1453 0.53 0.70 0.45 184 FORGED_GMAIL_RCVD 1434 0.56 0.69 0.50 185 RDNS_DYNAMIC 1423 0.50 0.68 0.42 186 TR_Mismatch_TLD_02 1418 0.26 0.68 0.05 187 XMGppyBdWords 1398 0.36 0.67 0.21 188 RCVD_IN_MSPIKE_WL 1344 1.78 0.64 2.34 189 XM_Nigeria_01 1343 0.23 0.64 0.03 190 RCVD_IN_IADB_OPTIN 1337 2.15 0.64 2.89 191 RCVD_IN_MSPIKE_H3 1326 1.78 0.64 2.34 192 T_FILL_THIS_FORM_LONG 1320 0.46 0.63 0.37 193 BAYES_05 1294 1.29 0.62 1.62 194 HTML_IMAGE_ONLY_24 1288 0.46 0.62 0.38 195 XM_S_JOY_D 1278 0.40 0.61 0.30 196 KHOP_DYNAMIC 1201 0.61 0.58 0.62 197 XM_Body_Obfu01 1191 0.31 0.57 0.19 198 XMGappySubj_01 1172 0.53 0.56 0.51 199 NML_ADSP_CUSTOM_MED 1152 0.72 0.55 0.81 200 XMSubMetaSxObfu_03 1151 0.40 0.55 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 371549 90.21 95.91 87.41 2 DKIM_SIGNED 297857 73.50 80.47 70.07 3 XM_DK_Pass 291984 71.99 78.70 68.69 4 DCC_CHECK_NEGATIVE 274060 49.98 20.46 64.48 5 DKIM_VALID 273818 67.83 74.77 64.42 6 BAYES_50 249464 49.37 30.39 58.69 7 XMListUnsubscribeExists 192255 52.79 68.18 45.23 8 DKIM_VALID_AU 188707 48.83 57.86 44.40 9 DCC_CHECK 142658 48.16 77.89 33.56 10 XM_H_QuotedFrom 141521 39.04 50.73 33.29 11 T_TM2_M_HEADER_IN_MSG 130927 27.94 22.11 30.80 12 HTML_FONT_LOW_CONTRAST 112967 29.17 34.44 26.58 13 DKIM_VALID_EF 111491 24.54 21.09 26.23 14 LOC_TINY_FONT_1 89434 25.25 33.84 21.04 15 FVGT_m_MULTI_ODD 88929 22.26 24.99 20.92 16 ALL_TRUSTED 82760 13.47 1.25 19.47 17 XMSubLong 79538 21.54 27.30 18.71 18 MIME_HTML_ONLY 76671 24.36 37.22 18.04 19 MultiRelay 76425 17.13 15.41 17.98 20 T_KAM_HTML_FONT_INVALID 62046 16.33 19.86 14.60 21 XM_DK_Undo_02 56212 24.35 47.02 13.22 22 BAYES_99 53123 22.98 44.33 12.50 23 XM_Body_Dirty_Words 48876 13.84 18.61 11.50 24 XM_DKIMWhitelistDomains 46614 7.37 0.05 10.97 25 BAYES_999 46238 19.57 37.27 10.88 26 XM_Multi_Part_URI 45922 13.76 19.77 10.80 27 TooManyTo_001 43695 9.26 7.17 10.28 28 LOTS_OF_MONEY 42789 10.55 11.53 10.07 29 LotsOfNums_01 35847 7.83 6.61 8.43 30 RCVD_IN_RP_SAFE 32507 6.95 5.53 7.65 31 XM_Evil_Numbers_Gen 31383 9.11 12.61 7.38 32 T_XMDrugObfuBody_14 30996 8.03 9.52 7.29 33 BAYES_00 30443 5.31 1.55 7.16 34 HTML_IMAGE_RATIO_02 29363 9.83 15.77 6.91 35 FSL_BULK_SIG 29171 9.15 13.82 6.86 36 BAYES_60 28761 6.80 6.86 6.77 37 ANY_BOUNCE_MESSAGE 28609 4.76 0.75 6.73 38 BOUNCE_MESSAGE 28606 4.76 0.75 6.73 39 RCVD_IN_RP_CERTIFIED 28368 5.71 3.76 6.67 40 RELAYCOUNTRY_META 27893 10.02 17.06 6.56 41 RCVD_IN_IADB_LISTED 27193 5.02 2.22 6.40 42 TR_DCC_Bayes_99 25612 15.24 34.02 6.03 43 MIME_QP_LONG_LINE 25471 5.50 4.50 5.99 44 DKIM_INVALID 24039 5.67 5.69 5.66 45 HTML_IMAGE_RATIO_04 23815 6.74 9.05 5.60 46 RCVD_IN_IADB_SPF 23450 4.36 2.00 5.52 47 XM_H_Long_From01 23230 6.03 7.19 5.47 48 BOTNET_IPINHOSTNAME 22624 7.53 12.03 5.32 49 XM_SendGrid 21804 4.90 4.43 5.13 50 RCVD_IN_MSPIKE_H2 21415 4.47 3.31 5.04 51 XM_PDF 20684 3.54 0.82 4.87 52 IN_ZIMBRA_NJ_WHITELIST 20391 3.23 0.03 4.80 53 RCVD_IN_IADB_SENDERID 20238 3.82 1.91 4.76 54 TR_XM_DK_Bayes 19885 3.57 1.30 4.68 55 RCVD_IN_IADB_DK 19829 3.75 1.88 4.67 56 T_REMOTE_IMAGE 19800 4.07 2.86 4.66 57 T_TooManySym_01 19632 4.11 3.07 4.62 58 RCVD_IN_IADB_VOUCHED 18959 3.33 1.02 4.46 59 XM_B_Phish_Phrases 18610 5.68 8.33 4.38 60 UNPARSEABLE_RELAY 18107 3.37 1.56 4.26 61 TR_XM_DK_Bayes1 17654 3.18 1.20 4.15 62 BAYES_80 17085 5.45 8.38 4.02 63 TVD_RCVD_IP 16295 2.67 0.30 3.83 64 XMSubMetaSx_00 16053 4.85 7.03 3.78 65 BAYES_40 15744 2.95 1.40 3.70 66 TR_XM_DocInvoice 15260 4.63 6.76 3.59 67 XMStrtUSub 15118 3.67 3.91 3.56 68 HTML_IMAGE_RATIO_06 15050 4.93 7.77 3.54 69 FROM_EXCESS_BASE64 14461 6.11 11.61 3.40 70 TR_XM_DK_Bayes2 14078 2.56 1.04 3.31 71 XMNumbers 14052 4.13 5.80 3.31 72 XMSexyCombo_05 13746 5.68 10.67 3.23 73 XM_UncommonTLD01 13350 5.54 10.44 3.14 74 UNTRUSTED_Relay 12796 5.67 11.10 3.01 75 TooManyTo_002 12620 2.37 1.14 2.97 76 RCVD_IN_IADB_OPTIN 12268 2.15 0.64 2.89 77 BAYES_20 11638 2.21 1.14 2.74 78 XM_H_Long_From02 11634 2.56 2.19 2.74 79 BAYES_95 11548 3.56 5.28 2.72 80 MPART_ALT_DIFF 11515 4.59 8.43 2.71 81 XM_UB50 10945 3.23 4.56 2.57 82 MIME_HTML_MOSTLY 10822 3.31 4.85 2.55 83 HTML_MIME_NO_HTML_TAG 10298 4.90 9.95 2.42 84 RCVD_IN_MSPIKE_WL 9954 1.78 0.64 2.34 85 RCVD_IN_MSPIKE_H3 9948 1.78 0.64 2.34 86 TM2_M_URI_OPT_OUT 9645 3.80 6.90 2.27 87 TooManyTo_003 9528 1.84 1.03 2.24 88 MAILING_LIST_MULTI 9352 1.88 1.23 2.20 89 HTML_IMAGE_RATIO_08 8480 2.49 3.49 2.00 90 XM_SPF_SoftFail 8349 2.35 3.13 1.96 91 RELAYCOUNTRY_PH 8198 1.30 0.01 1.93 92 XM_DIRTYINTL 8146 2.60 3.99 1.92 93 URI_HEX 7949 2.25 3.02 1.87 94 TR_Symld_Words 7727 1.63 1.23 1.82 95 XMDiploma_00 7715 2.04 2.50 1.82 96 XM_DK_Undo_01 7657 1.62 1.26 1.80 97 SUBJ_ALL_CAPS 7655 1.95 2.26 1.80 98 IN_HORDE_ADDRESS_BOOK 7648 1.23 0.07 1.80 99 T_TooManySym_02 7615 1.59 1.18 1.79 100 HELO_NODOT 7268 1.22 0.23 1.71 101 INVALID_MSGID 7014 1.18 0.23 1.65 102 BAYES_05 6900 1.29 0.62 1.62 103 USER_IN_DEF_DKIM_WL 6603 1.07 0.08 1.55 104 XM_CamelCaseFrm001 6564 2.12 3.28 1.54 105 TO_MALFORMED 6391 1.01 0.01 1.50 106 T_XMDrugObfuBody_00 6185 1.43 1.37 1.46 107 T_XMDrugObfuBody_08 6007 2.04 3.30 1.41 108 URI_TRY_3LD 5787 1.30 1.16 1.36 109 XM_OfRef6 5707 1.65 2.28 1.34 110 RELAYCOUNTRY_CA 5579 1.90 3.10 1.31 111 XM_H_PHPOS 5544 1.15 0.82 1.30 112 XMCapTrack 5424 1.02 0.50 1.28 113 XMPhish11 5164 1.28 1.42 1.21 114 XM_GoogleGroups 5007 0.92 0.40 1.18 115 BOTNET 4935 4.97 12.73 1.16 116 XMLngstWrd_00 4911 0.89 0.35 1.16 117 XMStockSpam_06 4775 1.14 1.16 1.12 118 DKIM_ADSP_CUSTOM_MED 4686 1.00 0.79 1.10 119 TooManyTo_004 4629 0.99 0.80 1.09 120 MIME_HTML_ONLY_MULTI 4628 1.95 3.70 1.09 121 HTML_FONT_SIZE_HUGE 4596 2.37 5.01 1.08 122 XMGenDplmaNmb 4526 1.28 1.73 1.06 123 HTML_IMAGE_ONLY_08 4475 2.31 4.88 1.05 124 XMLngstWrd_01 4361 0.79 0.32 1.03 125 RELAYCOUNTRY_GB 4293 1.08 1.22 1.01 126 HTML_SHORT_LINK_IMG_1 4126 2.29 4.98 0.97 127 SHORTENER_SHORT_IMG 3985 2.22 4.84 0.94 128 URI_BUFFLY 3985 2.22 4.83 0.94 129 XM_ProductURIs 3985 1.08 1.37 0.94 130 TooManyTo_005 3830 0.84 0.71 0.90 131 T_FILL_THIS_FORM_SHORT 3768 0.91 0.97 0.89 132 TM2_M_VERY_LONG_WORD 3578 1.03 1.41 0.84 133 NML_ADSP_CUSTOM_MED 3434 0.72 0.55 0.81 134 NO_DNS_FOR_FROM 3429 0.94 1.21 0.81 135 USER_IN_WHITELIST 3324 0.52 0.00 0.78 136 XM_D_tchamptons_WL 3221 0.51 0.00 0.76 137 TR_MetaPhish_Combo_01 3134 0.66 0.49 0.74 138 XMSubMetaI_00 3068 1.06 1.76 0.72 139 XMBdyGiftCard01 3030 1.12 1.94 0.71 140 XMNoVowels 2989 0.63 0.48 0.70 141 T_TooManySym_03 2915 0.58 0.37 0.69 142 SpammyFromTLD_01 2868 0.88 1.29 0.67 143 DIET_1 2843 1.16 2.16 0.67 144 T_Symld_Words_02 2823 0.78 1.03 0.66 145 XMSubMetaSxObfu_02 2687 0.53 0.32 0.63 146 XM_H_PHPMailer 2660 0.65 0.70 0.63 147 KHOP_DYNAMIC 2642 0.61 0.58 0.62 148 T_OBFU_PDF_ATTACH 2507 0.47 0.24 0.59 149 XMLngstWrd_02 2398 0.47 0.27 0.56 150 TM2_M_A_HREF_HREF 2360 0.55 0.55 0.56 151 XMHTMLBadTable_001 2256 0.75 1.19 0.53 152 T_MANY_PILL_PRICE 2226 0.35 0.01 0.52 153 T_XMHurry_00 2179 0.81 1.42 0.51 154 URI_NOVOWEL 2168 0.63 0.87 0.51 155 XMGappySubj_01 2158 0.53 0.56 0.51 156 FORGED_GMAIL_RCVD 2142 0.56 0.69 0.50 157 XM_ShortIntro_01 2118 0.46 0.37 0.50 158 MISSING_HEADERS 2117 1.99 5.03 0.50 159 TR_XM_RelayPhish 2082 0.78 1.37 0.49 160 TM2_M_BODY_EMPTY 2058 0.35 0.09 0.48 161 XMMoneyMeta_00 2056 0.69 1.10 0.48 162 XMBrknScrpt_02 2038 0.67 1.05 0.48 163 XMSexyCombo_01 2029 0.99 2.04 0.48 164 HTML_TAG_BALANCE_BODY 2026 0.74 1.26 0.48 165 XMBody_17 2023 0.78 1.40 0.48 166 RELAYCOUNTRY_AU 1991 0.48 0.50 0.47 167 FILL_THIS_FORM 1924 0.53 0.70 0.45 168 HTML_IMAGE_ONLY_28 1911 0.42 0.37 0.45 169 SHORT_HELO_AND_INLINE_IMAGE 1887 0.32 0.07 0.44 170 HTML_FONT_FACE_BAD 1878 0.59 0.90 0.44 171 XMHTML_After_End 1869 0.75 1.39 0.44 172 XMBody_95 1864 0.34 0.14 0.44 173 XM_B_REG_HTML 1856 0.55 0.79 0.44 174 HTML_IMAGE_ONLY_32 1843 0.36 0.22 0.43 175 RELAYCOUNTRY_DE 1811 0.57 0.85 0.43 176 RCVD_IN_SORBS_DUL 1807 0.36 0.24 0.43 177 XM_B_COPY_HTML 1788 0.61 1.00 0.42 178 RDNS_DYNAMIC 1771 0.50 0.68 0.42 179 AC_DIV_BONANZA 1740 0.31 0.11 0.41 180 HTTPS_HTTP_MISMATCH 1695 0.51 0.74 0.40 181 XMDateMe_00 1659 0.39 0.40 0.39 182 XMPhish30 1615 0.71 1.38 0.38 183 HTML_IMAGE_ONLY_24 1613 0.46 0.62 0.38 184 XMRcvdHeader_15 1590 0.25 0.00 0.37 185 SpammyFromTLD_02 1588 2.54 6.94 0.37 186 T_FILL_THIS_FORM_LONG 1565 0.46 0.63 0.37 187 RCVD_IN_BL_SPAMCOP_NET 1564 1.35 3.35 0.37 188 XMLngstWrd_03 1554 0.30 0.16 0.37 189 XM_Combo_Sbj 1547 0.42 0.55 0.36 190 XMBody_78 1495 0.63 1.20 0.35 191 XM_H_PHPOS_M 1474 0.35 0.35 0.35 192 PLING_QUERY 1453 0.58 1.07 0.34 193 DKIM_ADSP_NXDOMAIN 1453 1.27 3.16 0.34 194 XMSolicitRefs_0 1447 0.38 0.46 0.34 195 XMSubNoVowel 1432 0.35 0.39 0.34 196 XMSubMetaSxObfu_03 1374 0.40 0.55 0.32 197 T_MONEY_PERCENT 1357 0.65 1.34 0.32 198 TR_LOTS_OF_MONEY2 1357 0.65 1.34 0.32 199 FILL_THIS_FORM_LOAN 1317 0.39 0.55 0.31 200 REMOVE_BEFORE_LINK 1300 0.49 0.86 0.31 ----------------------------------------------------------------------